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Abstract: Although there are ongoing efforts to extend the ISS life cycle through 2028, the 
International Space Station (ISS) end-of-life (EOL) cycle is currently scheduled for 2020. The EOL 
for the ISS will require de -orbiting the ISS. This will be the largest manmade object ever to be de- 
orbited, therefore safely de -orbiting the station will be a very complex problem. This process is being 
planned by NASA and its international partners. Numerous factors will need to be considered to 
accomplish this such as target corridors, orbits, altitude, drag, maneuvering capabilities, debris 
mapping etc. The ISS EOL Probabilistic Risk Assessment (PRA) will play a part in this process by 
estimating the reliability of the hardware supplying the maneuvering capabilities. The PRA will 
model the probability of failure of the systems supplying and controlling the thrust needed to aid in the 
de -orbit maneuvering. 
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1. INTRODUCTION 

When the ISS is de-orbited it will be the largest manmade object to ever reenter the earth’s 
atmosphere. This presents numerous technical challenges as well as logistical problems to the ISS 
international partners. The target risk to the ground population is less than 1 in 10,000 for a single 
Progress option. (Note that the estimated energy for a loss of life incident is an impact to a person of 
about the energy of a baseball pitched by a major league pitcher or about 130 joules). This paper 
presents the structure of planned re-entry using a single Russian Progress M cargo vehicle and the ISS 
Service Module (SM) for re-entry maneuvering. This plan is being reevaluated and will probably be 
revised to use three Progress M vehicles to supply re-entry maneuvering; however, the structure and 
methodology will be similar. Because of the sensitive nature of the material, quantitative values will 
not be presented here. 

There are many driving factors that will play into the successful re-entry of the ISS. These include 
vehicle inclination, altitude at start of re-entry sequence, first interface with atmosphere, and breakup 
sequence. Experiments are being performed to collect data on these parameters. Because of these 
factors there will be uncertainty in the plan even if the hardware functions nominally. The PRA 
team’s role in this process is to model the probability that the hardware will successfully provide the 
thrust necessary to support the planned re-entry. 

2. RE-ENTRY PLAN 

The re-entry plan is still in a preliminary planning stage. The current plan is outlined below: 

• Planned ISS EOL will begin with natural drag from 400km to final operations stalling at 
200km. This phase will last over a year with only phasing burns to nearly 200km with a 
circular orbit. 

• ISS will be reduced to a 3-man crew. 

• Two decision points in the final week will allow holds, if needed, with the same intended 
ground track available 4 days and 1 day later than first planned. 

• Numerous consecutive -orbit preparatory burns will shape the final orbit using Progress 
rendezvous and docking (R&D) thrusters. 
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• Ballistic/altitude plan leading into the final burn will support an optimized combination of 
abort capability and projected footprint that is completely contained in the ocean. 

• Final burn will be a combination of (up to) three Progress M vehicles, and propulsion 
enhancements selected below. This analysis considers a single Progress case. 

o SM main engine 

o Cross-flow of aft Progress resupply tanks to aft Progress main engine 
o Burn time extension of Progress R&D engines 

• ISS will be in an aerodynamically -trimmed configuration with its center of pressure behind 
the center of drag, and minimum exposure of solar arrays to RAM pressures. 

3. APPROACH 

Industry standard event tree and fault tree methodology will be used to model the hardware systems 
required for successful ISS re-entry. Although many of the systems required are already modeled in 
the ISS PRA Progress R&D and ISS SM models, there are still modeling challenges ahead. Some of 
the hardware, such as thrusters, may be required to operate outside of their design parameters. In these 
cases, the use of the current failure rate data, developed for nominal operations, will need to be 
reassessed. Test data could help fill in the gaps between data acquired for nominal cases and data to 
evaluate a system challenged beyond its design constraints. 

4. ANALYSIS 

Figure 1: ISS EOL Re-entry Burn Sequence, Single Progress Option 



' Optional Time Extension 


Burn 1 utilizes Progress R&D Engines, Burn 2 utilizes Progress R&D and Main Engines, Burn 3 uses 
the ISS SM engines, and Burn 4 is a contingency burn which could be used to make up failures that 
occur during the first three burns. Event Sequence Diagrams (ESDs) (Figures 2 through 8) were 
developed for the planned re-entry scenarios. 

The single Progress planned re-entry will rely on the burn sequence presented in Figure 1 . This plan, 
once initiated, can accommodate up to two abort/restart sequences as needed on subsequent orbits. 
The ESDs could result in the five possible end states listed below: 

• P n = Nominal Re-entry 

• P r = Random Re-entry 

• P p = Pseudo Random 

• Pi = Large Under-Burn 

• P s = Small Under-Burn 
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Figure 2: ISS EOL ESD De-Orbit Attempt 1 



To Figure 3 To Figure 4 To Figure 5 


Figure 2 presents the initial re-entry attempt. There are 3 paths that result in re-entry: Nominal, Small 
Under-Burn, and Large Under-Burn. Three abort paths are included: abort to Attempt 2 with a restart 
at Burn 1, abort to Attempt 2 with a restart at Burn 2, and abort to Attempt 2 by resuming Burn 2. 

Figure 3: ISS EOL ESD Attempt 2 Restart Burn 1 



From Figure 2 





To Figure 6 


To Figure 7 To Figure 8 


Figure 3 is the first of three abort trees from Attempt 1 ; this tree assumes the burn sequence will restart 
from the beginning. There are 3 paths that result in re-entry: Nominal, Small Under-Burn, and Large 
Under-Burn. Three abort paths are included: abort to Attempt 3 with a restart at Bum 1, abort to 
Attempt 3 with a restart Burn 2, and abort to Attempt 3 by resuming Burn 2. 


Figure 4: ISS EOL ESD Attempt 2 Resume Burn 2 


From Figure 2 



To Figure 7 


To Figure 8 


Figure 4 is the second of the aborts possible from Attempt 1 and assumes Burn 1 completed and so 
this burn will restart from the beginning of Burn 2. There are 3 paths that result in re-entry: Nominal, 
Small Under-Bum, and Large Under-Bum. Two abort paths are possible: abort to Attempt 3 with a 
restart at Burn 2, and abort to Attempt 3 with a restart at Burn 3. 
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Figure 5: ISS EOL ESD Attempt 3 Resume Burn 2 



To Figure 7 


To Figure 8 



Figure 5 is the third of the aborts possible from Attempt 1 and assumes Burn 2 was aborted while in 
progress. There are 3 paths that result in re-entry: Nominal, Small Under-Burn, and Large Under- 
Bum. Two abort paths are possible: abort to Attempt 3 with a restart at Burn 2, and abort to Attempt 3 
by resuming Burn 2. 

Figures 6, 7, and 8 model Attempt 3, which is the final attempt to complete the process - there are no 
abort paths possible. At this point Nominal Re-entry can still be achieved. 

Figure 6 - Attempt 3 ISS EOL ESD Restart Burn 1 




Figure 7 - ISS EOL ESD Attempt 3 Restart Burn 2 
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Figure 8 - ISS EOL ESD Attempt 3 Restart Burn 3 



From Figure 4 or 5 




The end states from the model are P n (Nominal Re-entry), P r (Random Re-entry), P p (Pseudo 
Random), P! (Large Under-Burn) and P s (Small Under-Burn), and will be binned into the following 
Footprints. 


• Nominal Footprint 

• Ocean Footprint 

• Populated Footprint 

Figure 9 shows the potential footprints for the start of the re-entry process. 

Figure 9 - ISS Re-entry Footprints 
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Figure 10 is the type of chart that will be used to present the PRA results, once completed. 


Figure 10 - Example: Probability of ISS Re-entry Footprints 


Nominal 



Ocean Footprint 


Populated Footprint 




DISCLAIMER : 

Not representative of actual data 


Left-point: 5 th percentile 
Break-point: Mean 
Right-point: 95 th percentile 
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5. METHODOLOGY 

ISS PRA will utilize event tree/fault tree methodology. Some of the challenges facing the ISS PRA 
team are discussed in this section. 

Any analyst that has attempted to model common cause using Multiple Greek Letter or Alpha Models 
knows it gets convoluted after about four components. The Progress has 28 thrusters and the ISS SM 
has 32 thrusters, whose redundancy and similar design make them susceptible to common cause 
failures. The Global Alpha Model (as described in NUREG/CR-5485) [1] can be used to represent the 
system common cause contribution, but NUREG/CR-5496 [2] supplies global alpha parameters for 
groups only up to size six. Because of the large number of redundant thrusters on each vehicle, 
regression is used to determine parameter values for groups of size larger than six. An additional 
challenge is that thruster failures must occur in specific combinations in order to fail the propulsion 
system; not all failure groups of a certain size are critical. The calculation of common cause will 
become even more complicated if the ISS program opts to use the thrusters on three Progress vehicles 
in addition to the SM to de -orbit the ISS vehicle. The methodology that will be used to model 
common cause failures of the thrusters required to de-orbit the ISS has already been used to model 
common cause failure of thrusters on the ISS Visiting Vehicles and is described in “ Modeling 
Common Cause Failures of Thrusters on ISS Visiting Vehicles ” [3]. 

Fault trees are based on Boolean algebra failures and therefore failures are generally bounded as failed 
or operational - this makes modeling difficult in an area where reduced performance issues can occur. 
The challenge is mapping thrusters under performance issues into bins and establishing how these 
under-performance issues will stack up if they occur in sequence. There is also difficulty in dealing 
with hard thruster failures in cases where the thruster vectoring can be equaled or approximated by 
other thruster combinations. 

There are current Progress models accounting for functional failures during R&D operations; 
however, these models focus on motion control and include propulsion and supporting control systems 
and power systems. The current models are in the process of being refined for this re-entry analysis. 
The command and control of the overall de-orbit vehicle configuration, whichever configuration is 
selected (single Progress with SM or three Progress) will also pose a challenge. Once the burn 
sequence begins, the de -orbit maneuver becomes software-dependent, and the current model does not 
account for software reliability. 
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6. CONCLUSION 


The ISS EOL and resulting vehicle de-orbit will be a highly publicized event involving many nations - 
those invested in the safe completion of the ISS Program, and those potentially affected by the 
footprint of the ISS debris following re-entry. The ISS EOL PRA will contribute to the planning and 
safe execution of this event by capturing the probability of hardware failures associated with ISS EOL. 
The PRA will be used as one of the components of the overall plan, to assist in ISS Program decisions 
regarding vehicle configuration as measured against the likelihood of success. The ISS EOL PRA 
package will be integrated into the overall risk plan for ISS EOL re-entry, and may be used by the 
agency to accept any residual risk (complete with uncertainty bounds) to the general population. 

References 

[1] U.S. Nuclear Regulatory Commission, Guidelines on Modeling Common-Cause Failures in 
Probabilistic Risk Assessment, NUREG/CR-5485 , November 1998. 

[2] U.S. Nuclear Regulatory Commission, CCF Parameter Estimations , 2009 Update to 
NUREG/CR-5496 , January 2011. 

[3] Haught, Megan, Modeling Common Cause Failures of Thrusters on ISS Visiting Vehicles, 
Probabilistic Safety Assessment and Management (PSAM), Honolulu, Hawaii, June 2014. 


Probabilistic Safety Assessment and Management PSAM 12, June 2014, Honolulu, Hawaii 

* gary.w.duncan@nasa.gov 



